Network-Security on CuraSec

Android 17 Adds OS-Wide Encrypted Client Hello for Connection Privacy

Fri, 28 Aug 2026 21:21:40 +0000

Engineer — Learn: ECH support in Android 17 is a platform-level change worth tracking for mobile app TLS compatibility and enterprise network inspection assumptions, but requires no immediate action on running systems.
SOC/IR — Skip
Leader — Skip

Thu, 27 Aug 2026 21:01:55 +0000

Engineer — Learn: ECH support in Android 17 may affect how TLS inspection tools or corporate proxies handle traffic from managed Android devices; worth evaluating impact on your mobile security stack.
SOC/IR — Skip
Leader — Skip

Wed, 12 Aug 2026 11:57:00 +0000

Engineer — Act: CISA KEV listed, actively exploited in the wild, and a public PoC exists — patch Cisco ASA and FTD software immediately per Cisco’s advisory for CVE-2026-20349; perimeter firewall availability is at direct risk from unauthenticated remote attackers.
SOC/IR — Act: Active exploitation of an edge security appliance warrants an assume-breach sweep — hunt for anomalous or malformed HTTP requests targeting ASA/FTD management interfaces and investigate any unexplained firewall availability incidents since this KEV listing date.
Leader — Plan: A CISA KEV-confirmed flaw in widely deployed perimeter firewalls is a priority patching event — confirm your engineering team has this on the sprint and assess whether any availability SLAs tied to ASA/FTD deployments are at risk; DoS scope limits board-level urgency but warrants direct follow-up with the team.
Signals: CVE-2026-20349 — CISA KEV: listed, EPSS n/a, public PoC on GitHub

Fri, 07 Aug 2026 00:21:58 +0000

Engineer — Plan: Three CVSS 9.8 flaws in widely deployed Cisco Catalyst SD-WAN and IOS XE warrant prioritized patching, but no KEV listing, public PoC, or active exploitation is reported. Schedule patching to the latest Cisco-recommended releases this sprint, prioritizing any internet-exposed SD-WAN or IOS XE autonomous-mode devices.
SOC/IR — Skip
Leader — Skip

Wed, 05 Aug 2026 13:01:27 +0000

Engineer — Plan: If you run TP-Link Omada for network management, schedule patching of the ZTP component this sprint — 15 chainable vulns with RCE potential are high severity, though no KEV listing or public PoC currently raises the urgency to emergency status.
SOC/IR — Skip
Leader — Skip

Mon, 20 Jul 2026 14:31:24 +0000

Engineer — Skip
SOC/IR — Learn: Academic research showing a feature-aggregation technique that improves IDS accuracy by up to 7% while cutting data volume significantly — worth tracking if evaluating or tuning ML-based network detection models, but no tooling or deployable artifact yet.
Leader — Skip

Mon, 20 Jul 2026 14:31:24 +0000

Engineer — Skip
SOC/IR — Learn: Research shows adding entropy-based features to supervised traffic classifiers reduces misclassifications in high-variability scenarios; worth evaluating if the team maintains its own ML-based detection pipeline.
Leader — Skip